Markdown Editor
Open the editor

Privacy Officer (DPO) Kit

Run a privacy programme: records of processing, notices, DPIA, LIA and TIA, data subject requests, breach assessment and processor contracts.

14 templates in 4 steps, in the order you use them. Open any template in the editor, fill it in and export it to PDF, DOCX or HTML.

Step 1

Discovery

  1. GDPR Record of Processing Activities (ROPA) Template

    Full

    GDPR Art. 30 record: controller fields (1)(a)-(g), processor fields (2)(a)-(d), lawful basis, classification, retention rule, Chapter V transfers

    GDPR Art. 30; Chapter V (Art. 44-49)

  2. Privacy Policy Template (GDPR, CCPA, COPPA)

    Full

    Applicability check, controller and DPO, data inventory with sources, purposes and retention, sale/share statements, GDPR and CCPA rights, ADMT, COPPA, notice at collection

    GDPR Arts. 12-22; CCPA/CPRA with CPPA regulations (eff. 2026-01-01); COPPA Rule amended 2025

  3. CCPA Notice at Collection and Opt-out Page Template

    Standard

    CCPA notice at collection: placement plan, categories with retention, workforce variant, Do Not Sell or Share page, signal status, third parties, checklist

    CCPA Civ. Code 1798.100, 1798.135; CCPA Regs ss. 7012-7015, 7025, 7026 (eff. 2026-01-01)

  4. Cookie Policy Template (EU ePrivacy, UK PECR, CCPA)

    Full

    Cookie policy: applicability check, watch list, consent banner checklist, categories, cookie list, choices and GPC, third parties, consent records

    ePrivacy Directive 2002/58/EC Art. 5(3); GDPR Arts. 4(11), 7; UK PECR reg. 6 (DUAA 2025); CCPA regs s. 7025
Step 2

Assessments

  1. Data Protection Impact Assessment (DPIA) Template

    Full

    GDPR Art. 35 DPIA: WP248 screening, processing description, necessity, scored risk register, measures, DPO advice, Art. 36 prior consultation, review

    GDPR Art. 35-36; WP248 rev.01 (EDPB-endorsed); EDPB DPIA template v1.0 (2026)

  2. Legitimate Interests Assessment (LIA) Template, GDPR Art. 6(1)(f)

    Standard

    Purpose, necessity and balancing test for GDPR Art. 6(1)(f), field-level necessity, impacts and safeguards, outcome, right to object, UK notes

    GDPR Art. 6(1)(f); EDPB Guidelines 1/2024 (v1.0)

  3. Transfer Impact Assessment (TIA) Template, GDPR Chapter V

    Standard

    EDPB six-step TIA for one Art. 46 transfer: transfer facts, tool, destination law, supplementary measures, procedural steps, re-evaluation, UK and US notes

    EDPB Recommendations 01/2020 v2.0; SCCs (EU) 2021/914

  4. Data Residency and Sovereignty Assessment Template (GDPR Chapter V)

    Full

    Data tiers, flow map, jurisdiction matrix, Chapter V mechanisms, TIAs, PIPL and DPDP examples, Data Act Art. 32, key custody, sovereign cloud scoring, decision

    GDPR Chapter V; SCCs 2021/914; EU-US DPF 2023/1795; EDPB Recommendations 01/2020 v2.0; Data Act Art. 32

  5. CCPA Risk Assessment and Cybersecurity Audit Template

    Full

    CCPA risk assessment and cybersecurity audit record: 7150 screening, 7152 report, ADMT, 45-day updates, Agency submission, audit scope, report and certification

    CCPA regulations, Cal. Code Regs. tit. 11 ss. 7120-7124, 7150-7157 (effective 2026-01-01)
Step 3

Operations

  1. Data Subject Request Procedure Template (GDPR DSAR, CCPA)

    Full

    DSAR procedure: rights by regime, intake, identity checks, search plan, GDPR and CCPA deadlines, exemptions, per-right checklists, letters, log, metrics

    GDPR Arts 12-23; EDPB Guidelines 01/2022 v2.1; CCPA Civ. Code 1798.100 ff.; CCPA Regulations (eff. 2026-01-01)

  2. Personal Data Breach Assessment Template (GDPR Art. 33 and 34)

    Full

    Breach triage, awareness and 72-hour clock, risk to individuals, Art. 33/34 notification decision, authority and data subject texts, breach log entry

    GDPR Arts 33-34; EDPB Guidelines 9/2022 v2.0
Step 4

Contract

  1. Data Processing Agreement (DPA) Template (GDPR Art. 28)

    Full

    Controller-processor DPA: Art. 28(3)(a)-(h) terms, sub-processors, breach notice, audits, transfer tools (SCCs, DPF, UK IDTA), CCPA s. 7051 terms, annexes

    GDPR Art. 28; Commission SCCs 2021/915 and 2021/914; CCPA regs s. 7051

  2. Data Sharing Agreement Template (GDPR Controllers, EU Data Act)

    Full

    Parties and roles, purpose, data scope, lawful basis, joint-controller split, Data Act terms, transfers, security, retention, rights, breach notice, fees

    GDPR Arts. 26, 44-49; EU Data Act (Regulation (EU) 2023/2854); ICO data sharing code

  3. Sub-processor List Template (GDPR Art. 28)

    Lean

    Public sub-processor list: entity, service, data, location, transfer tool, affiliates, change notice and objection process, change log

    GDPR Art. 28(2), 28(4)